Extracted

• • Target
    stub.exe
  • Size 270KB
  • SHA256 d3a9a6bef9235736d16fbb5ae1239973528c6111e343e594d52cb26b4a8325dd
  • MD5 7af52a6b8df0806249bb5d0726cf9f98
  • SHA1 d1860e60c51164e139fa651a10483858de6910f7
  • SHA512 df72d544533045e45980e7577b74a40cd12998a79df57b3c5c45fdde692495db0e113cb96f6a80cd0af3afcabc9e668d52b2f828d4b468309ff10adc2c7bbccb
  • SSDEEP 3072:a4i5soxnlh9LDthje2tpZDzH4cacMwK+odL55EOabSkirKYhR3UHE+XHW6Yz:arHLDHdXy3waLQnWrKY8Y
  • TLSH
    T13F4429A833F88A10F6BF8B75987595444776B967AD17E70D198660CC2F32B90CE24F23
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryxorium_stealerpersistenceprivilege_escalationspywarestealer

  • Detects XoriumStealer payload

  • Family: XoriumStealer

    XoriumStealer is an information stealer written in C#.

    stealerxorium_stealer

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2